I have a network architecture that requires a port group on a distributed vSwitch to take a trunk link in and split traffic off to access ports, per vlan. I have a quick sketch of what I am trying to do. I am unclear as to how to do this (or if it is even possible) after reviewing documentation from Vmware and other sources. I don't think private vlans are the answer, and I don't see a way to use Q-in-Q.

Any help or insight is greatly appreciated.

NOTE: Traffic flows north to the internet and south to my private subnets/workstations, if that makes a difference.

NOTE 2: This is all software based. The router is a Cisco VM and the "devices" are individual firewall VMs.

If artistic merit is part of the criteria for posting, I may get down-voted

  • Your description and diagram make no sense to me. A dVS has physical uplink ports that carry all of the vlans defined within the dVS. Each portGroup is associated with a single access vlan [VLAN], a subset of vlans [TRUNK], or the private vlan. In theory, one can change the uplink pg to something other than 0-4094. – Ricky Jun 15 '16 at 18:49
  • Questions about VMs are off-topic here. You should try to ask this on Server Fault for a business network, or on Super User for a home network. – Ron Maupin Jun 15 '16 at 19:10
  • @RonMaupin This is related to a enterprise network I am working on. It is all software-defined, with VMs from prominent R/S vendors (Cisco and Juniper). Surely, this falls into that grey area between the disciplines? – khop Jun 15 '16 at 20:15
  • This answer on Network Engineering Meta is the last word on VMs: meta.networkengineering.stackexchange.com/a/406/8499. Also, it must have a paid support option from the vendor. – Ron Maupin Jun 15 '16 at 20:44
  • Roger, I guess I'll move this over to Server Fault... – khop Jun 16 '16 at 15:21

Port groups are the ports of the virtual switch that connect to virtual machines, uplink ports are ports of the virtual switch that are mapped to physical link.

  1. Create 3 different PortGroups on your VirtualDistributed Switch.

  2. Assign each vlan to a different port group

  3. Declare the uplink like a trunk port and permit 0 - 4096 vlan tags

  4. On the physical switch, the port that connect to your ESXi host, change it to a trunk port, for that you need to have access to the managment of the switch, or be with someone who has it.


If your router is a VM, you need to create a portgroup like trunk port and permit all the vlans, then, connect your VM on that port group.

That´s all

  • I now realize that I did not explicitly state this, but this is all software-defined. The router is a Cisco VM and the devices are firewall VMs. – khop Jun 16 '16 at 15:21
  • Just a few changes – Orlando Gaetano Jun 16 '16 at 15:40
  • Ah, I see what is going on. Thanks. I over complicated this in my head. – khop Jun 16 '16 at 17:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.